Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2022-3916

Keycloak: session takeover with oidc offline refreshtokens

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat Single Sign-On 7

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7.6.1

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 7

Default version status: affected

  • 0:18.0.3-1.redhat_00002.1.el7sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 7

Default version status: affected

  • 0:18.0.6-1.redhat_00001.1.el7sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 8

Default version status: affected

  • 0:18.0.3-1.redhat_00002.1.el8sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 8

Default version status: affected

  • 0:18.0.6-1.redhat_00001.1.el8sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 9

Default version status: affected

  • 0:18.0.3-1.redhat_00002.1.el9sso to < *unaffected

Red Hat Red Hat Single Sign-On 7.6 for RHEL 9

Default version status: affected

  • 0:18.0.6-1.redhat_00001.1.el9sso to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.6-15 to < *unaffected

Red Hat RHEL-8 based Middleware Containers

Default version status: affected

  • 7.6-20 to < *unaffected

References